Latest / Tech Talks With Kinsoft / Diagnosis Compromised: The Human Cost of Medical Data Leaks and the Privacy Fix

Transcript

Diagnosis Compromised: The Human Cost of Medical Data Leaks and the Privacy Fix · Tech Talks With Kinsoft

• 0:00
  Hello and welcome back to Tech Talks with Kinsoft.
• 0:02
  Great to be here. It is Friday, January 16th,
• 0:04
  2026. And, you know, there's usually that specific
• 0:09
  energy in the air this time of year. Right. The
• 0:11
  new year, new me feeling. Exactly. Everyone's
• 0:14
  back at their desks. The resolutions are still
• 0:16
  technically alive and we're all hoping for a
• 0:17
  fresh start. But looking at the stack of reports
• 0:20
  on the desk today, it seems the digital landscape
• 0:23
  didn't get the memo. No, it definitely did not.
• 0:27
  If anything, the holiday break just gave the
• 0:29
  threat actors time to reload. We're barely two
• 0:32
  weeks into 2026, and the sheer volume of data
• 0:35
  breaches hitting Australian infrastructure is
• 0:37
  frankly relentless. That's what I was thinking.
• 0:39
  And what's striking is that it isn't just the
• 0:41
  usual suspects. We're not just talking about
• 0:43
  big tech firms or banks. That is what jumped
• 0:45
  out at me going through this pile. Yeah. It feels
• 0:47
  like a scattergun approach. We're seeing, what,
• 0:49
  gold mines, primary schools, ear, nose, and throat
• 0:52
  specialists. It feels like no one is off limits.
• 0:56
  It looks like chaos, but when you zoom in, there
• 0:59
  is a logic to it. We have a lot to get through
• 1:02
  today. We really need to unpack this January
• 1:04
  onslaught to understand the immediate risks.
• 1:08
  Okay. But I also want to take us into the weeds
• 1:10
  on why the healthcare sector specifically is
• 1:14
  becoming such a massive target right now. And
• 1:17
  later, we have to talk about the future. You
• 1:19
  mean the sci -fi stuff we were talking about
• 1:20
  before? The sci -fi stuff that is becoming reality.
• 1:23
  Yeah, faster than we'd like. We're talking about...
• 1:25
  harvest now, decrypt later strategies involving
• 1:28
  quantum computing. Right. And the countermeasures,
• 1:30
  really heavy but fascinating math like homomorphic
• 1:34
  encryption, that might be the only way to save
• 1:37
  our privacy in the long run. Sounds intense but
• 1:39
  necessary. OK, let's start with the ground reality.
• 1:42
  We're looking at December 2025 into these first
• 1:45
  two weeks of January 2026. The reports call this
• 1:48
  a surge. Is that statistical or are we just paying
• 1:51
  more attention? Oh, it's absolutely statistical.
• 1:53
  The volume is staggering and the impact is hitting
• 1:56
  the most vulnerable demographics. I mean, look
• 1:58
  at the Victorian Department of Education breach
• 2:00
  that broke just this month. That was the one
• 2:02
  affecting all 1 ,700 government schools, right?
• 2:05
  Every single one. Yeah. Wow. And the detail here
• 2:08
  is, I mean, it's vital. It wasn't just. Current
• 2:10
  students, it was former students, too. Oh, that's
• 2:12
  bad. When you breach an education department,
• 2:15
  you're not just stealing a database of names.
• 2:17
  You're mapping out families. You have names,
• 2:20
  addresses, potentially behavioral records, special
• 2:24
  consideration notes. That is data that can be
• 2:27
  weaponized for identity theft against minors
• 2:30
  who might not realize their identity has been
• 2:32
  compromised for years. For years, exactly. It's
• 2:35
  a nightmare for parents. It's not like a credit
• 2:37
  card where you get a notification. It's silent.
• 2:39
  And then you pivot from the public sector to
• 2:41
  something like... Prezura, their car rental insurer,
• 2:45
  they got hit in January too. 300 ,000 customers
• 2:48
  exposed there. Right. And this illustrates the
• 2:50
  whole supply chain risk. Right. You might not
• 2:53
  think your car rental insurance is high risk
• 2:54
  data. It feels, you know, transactional, but
• 2:57
  it connects to your driver's license, your credit
• 2:59
  card, your travel habits, your home address.
• 3:02
  It's a full kit for a fraudster. And then we
• 3:05
  have the corporate heavy hitters, Regis Resources,
• 3:08
  an ASX listed gold producer. I have to admit,
• 3:12
  when I saw a gold mine hacked, my brain went
• 3:15
  to some movie scene. Right, where someone is
• 3:17
  digitally stealing gold bars. Yeah, which I know
• 3:20
  isn't how it works. Not quite the Italian job,
• 3:22
  no. But in a way, it's more damaging. When a
• 3:25
  resource giant like Regis gets breached, it rattles
• 3:29
  the market. It exposes supply chain contracts,
• 3:32
  geological data, employee records. It shows that
• 3:35
  physical security guards, fences. Doesn't translate.
• 3:38
  It doesn't translate to digital security. They're
• 3:40
  digital. walls came down in January. And we can't
• 3:43
  forget the University of Sydney breach from back
• 3:45
  in December that affected 27 ,000 people, staff,
• 3:49
  alumni, donors. It just feels like a free for
• 3:52
  all. Who is actually pulling the strings here?
• 3:54
  Well, we need to stop thinking of them as hackers
• 3:55
  in hoodies and start thinking of them as enterprises.
• 3:58
  As businesses. They are businesses. We're seeing
• 4:01
  attribution to specific ransomware groups like
• 4:03
  SafePay. They claimed the attacks on Beatsy Acres
• 4:06
  Jewelers and Snowbrand Australia recently. Then
• 4:09
  you have groups like INC Ransom and Quinlan.
• 4:12
  They have brands. That is wild. They have brands.
• 4:16
  They have HR departments. They have press releases.
• 4:18
  Yeah. And they have customer service desks to
• 4:21
  help you pay the ransom. It's... Ransomware as
• 4:23
  a service. Unbelievable. And they are operating
• 4:25
  aggressively in the Australian theater right
• 4:27
  now because they know the targets are rich. And
• 4:30
  frankly, the defenses are often lagging. That
• 4:34
  brings me to a statistic in the CISA report that
• 4:36
  I found incredibly frustrating. We talk about
• 4:39
  these sophisticated syndicates, you know, Quillen
• 4:42
  and SafePay. And I'm picturing laser grids and
• 4:45
  Mission Impossible stunts. Right. But the report
• 4:48
  says 90 percent of successful attacks still start
• 4:51
  with email. 90%. It is the most depressing statistic
• 4:55
  in cybersecurity. It has to be. You can spend
• 4:57
  millions on firewalls, intrusion detection, AI
• 5:00
  monitoring. But if someone in accounts payable
• 5:02
  receives an email that looks like an overdue
• 5:04
  invoice and they click that link, the millions
• 5:06
  of dollars of defense are just bypassed. So the
• 5:08
  human is the firewall and the human is tired,
• 5:11
  stressed and clicking things. Exactly. Social
• 5:14
  engineering exploits the human operating system,
• 5:17
  which hasn't been patched in about 200 ,000 years.
• 5:20
  We're curious, we're helpful, and we're fearful
• 5:22
  of authority. Phishing exploits all three. Well,
• 5:25
  that human vulnerability seems to be hitting
• 5:27
  one sector harder than any other right now. I
• 5:30
  want to shift focus to health care. Looking at
• 5:33
  the list, Point, Lonsdale Medical, Genie IVF,
• 5:37
  the ENT Center, it feels targeted. It is targeted,
• 5:40
  absolutely. Health care is the perfect storm
• 5:42
  for cybercrime. First, you have the value of
• 5:44
  the data. If your credit card is stolen, what
• 5:46
  do you do? I call the bank, cancel it, get a
• 5:48
  new one on Tuesday. It's annoying, but that's
• 5:51
  it. Right. It's an inconvenience. Now, what if
• 5:53
  your mental health records are stolen? What if
• 5:55
  your genetic profile is stolen or your history
• 5:57
  of addiction treatment? You can't cancel that.
• 5:59
  You cannot cancel your DNA. You can't change
• 6:01
  your medical history. That data is permanently
• 6:04
  valuable for blackmail, for synthetic identity
• 6:07
  theft, even for insurance fraud. The permanence
• 6:10
  is what makes it terrifying. The Genie IVF breach
• 6:12
  back in February 2025. That one really stuck
• 6:16
  with me. It should. The claim was somewhere between
• 6:19
  700 to 940 gigabytes of data. A terabyte. Nearly
• 6:23
  a terabyte. It's immense. And think about the
• 6:26
  nature of that data. Fertility treatment is incredibly
• 6:28
  intimate, emotional, financial. Exposing that
• 6:32
  is devastating. Of course. And the attackers
• 6:34
  know that hospitals and clinics are more likely
• 6:36
  to pay ransoms because lives and privacy are
• 6:38
  strictly on the line. But why are they so easy
• 6:41
  to get into? Is it just the phishing? Phishing
• 6:44
  is the entry, but the environment is the problem.
• 6:46
  We call it the systemic weakness of health care.
• 6:50
  You have this concept of medjack. Medical device
• 6:52
  hijacking. Exactly. Walk into a hospital room,
• 6:55
  you see MRIs, infusion pumps, patient monitors.
• 6:59
  Many of these are networked. So the MRI machine
• 7:01
  is on the Wi -Fi. Often, yes, to send images
• 7:04
  to the radiologist or patient data to the central
• 7:06
  server. But here's the kicker. That MRI machine
• 7:09
  might be running on Windows 7. Or even older.
• 7:11
  Or even Windows XP embedded. And it can't be
• 7:14
  patched. Why not? Just run an update. You often
• 7:16
  can't. If you update the operating system, you
• 7:19
  might void the FDA or TGA approval for that medical
• 7:22
  device. Or the vendor no longer supports it.
• 7:25
  So you have these multi -million dollar machines
• 7:27
  that are essentially open windows into the network.
• 7:30
  That reminds me of the Wannacray attack a few
• 7:32
  years back. The UK's National Health Service
• 7:34
  got absolutely leveled by that, didn't it? That
• 7:36
  is the classic case study. WannaCry wasn't even
• 7:40
  targeting hospitals specifically. It was a worm
• 7:43
  that just spread. But it crippled the NHS because
• 7:45
  they were reliant on obsolete Windows XP systems.
• 7:48
  Wow. Ambulances were diverted. Surgeries canceled.
• 7:51
  It proved that cybersecurity isn't an IT issue.
• 7:55
  It's a patient safety issue. There's a saying
• 7:57
  you mentioned in the notes about this sector.
• 7:59
  It was pretty cynical. There are only two types
• 8:01
  of health care organizations, those that know
• 8:03
  they've been hacked and those that don't. That
• 8:05
  is comforting. Not. It's the reality. And it's
• 8:08
  compounded by retention. In healthcare, you are
• 8:11
  legally required to keep patient records for
• 8:13
  decades, often 30 years or more. Right. So you're
• 8:16
  sitting on a dragon's hoard of data, protecting
• 8:19
  it with aging infrastructure, and humans who
• 8:22
  are stressed and clicking emails. Okay, so that
• 8:25
  is the here and now. We have sensitive data sitting
• 8:28
  on old computers. But the research you brought
• 8:30
  today points to something that honestly scared
• 8:32
  me more than the current breaches. This concept
• 8:36
  of harvest now, decrypt later. This is where
• 8:39
  we get into the strategic long -term threat.
• 8:42
  This is what intelligence agencies and advanced
• 8:45
  criminal groups are doing right now. Walk me
• 8:47
  through this, because usually if I encrypt my
• 8:49
  data, I feel safe. I see a little padlock icon
• 8:52
  I know my database is encrypted with. AES -256
• 8:56
  or whatever. Yeah. I assume if a hacker steals
• 8:58
  it, they just get gibberish. And for today, you're
• 9:00
  right. If they steal your encrypted database,
• 9:02
  it looks like random noise. They can't read it,
• 9:04
  but storage is cheap. So they keep it. They keep
• 9:07
  it. They harvest it. Waiting for what? A password
• 9:10
  leak? They're waiting for the math to break.
• 9:12
  Specifically, they're waiting for quantum computing.
• 9:14
  See, our current encryption RSA, which secures
• 9:18
  almost everything on the internet. It relies
• 9:20
  on a specific math problem. Factoring large numbers.
• 9:23
  Factoring very large numbers. It's incredibly
• 9:26
  hard for a classic computer to do. It would take
• 9:28
  millions of years. But a quantum computer changes
• 9:31
  the math. Fundamentally. There's a concept called
• 9:34
  Shor's algorithm. Without getting too bogged
• 9:36
  down in the physics, it's a quantum algorithm
• 9:38
  that can factor those large numbers terrifyingly
• 9:42
  fast. Once a quantum computer is powerful enough
• 9:45
  to run Shor's algorithm at scale, it acts like
• 9:48
  a skeleton key. So that encrypted file from 2026.
• 9:51
  Suddenly unlocks. It becomes plain text. So if
• 9:53
  I'm a hospital and I'm required to keep records
• 9:56
  for 30 years, data I save today might be safe
• 10:00
  for 5 or 10 years. But in year 11, the quantum
• 10:03
  computer comes online and suddenly all those
• 10:05
  secrets are out. Precisely. That is the decrypt
• 10:08
  later part. If you have data that needs to remain
• 10:10
  secret for 15, 20, 50 years. national secrets,
• 10:14
  genetic data, mental health records, you are
• 10:16
  already in the danger zone. We are racing against
• 10:19
  a clock we can't see. That makes data retention
• 10:21
  feel like a ticking time bomb. But you also mentioned
• 10:24
  another futuristic threat that's actually happening
• 10:26
  now involving AI. Shadow data. I've heard of
• 10:31
  shadow IT. Is this related? It's different and
• 10:33
  in some ways more insidious. This relates to
• 10:36
  how we use large language models or LLMs in business.
• 10:39
  Imagine a hospital trains a private AI on its
• 10:42
  internal records to help doctors write summaries.
• 10:45
  Which sounds like a great productivity tool.
• 10:47
  It is. But that AI model has now learned the
• 10:51
  patterns of that private data. Attackers are
• 10:53
  finding ways to use what we call constructive
• 10:55
  prompt injection. Is that like jailbreaking the
• 10:58
  AI? Sort of. They don't need to hack the database.
• 11:01
  They just talk to the AI. By asking a series
• 11:04
  of specifically designed questions, they can
• 11:06
  trick the model into regurgitating or reconstructing
• 11:09
  the training data. So they ask, tell me about
• 11:12
  the patient with a rare heart condition in room
• 11:14
  302. Or even more subtle queries that leverage
• 11:16
  the AI's pattern matching, like complete this
• 11:19
  sentence based on the clinical notes regarding
• 11:21
  patient X. The AI, trying to be helpful, fills
• 11:25
  in the blanks with the real confidential data
• 11:27
  it was trained on. So it leaks the secrets. It
• 11:29
  effectively leaks them. That reconstructed information
• 11:32
  is shadow data. That is wild. It's like the data
• 11:35
  is a ghost haunting machine. You can't find the
• 11:39
  file. But the machine knows the secret. And it's
• 11:41
  very hard to defend against because the AI is
• 11:44
  doing exactly what it was designed to do, predict
• 11:47
  the next word. Okay, I need a lifeline here.
• 11:49
  We've got quantum computers smashing our locks,
• 11:52
  AI chatting away our secrets. Please tell me
• 11:55
  the research included some solutions. Or should
• 11:58
  we just go back to pen and paper? Pen and paper
• 12:00
  has its own risks. No, there is hope. And ironically,
• 12:02
  the solution to the math problem is more math.
• 12:05
  Better math. Better math. There are two concepts
• 12:08
  that are critical for the next decade of privacy,
• 12:10
  differential privacy and homomorphic encryption.
• 12:13
  Let's break them down. Differential privacy,
• 12:15
  or DP, is this about hiding data? It's about
• 12:19
  hiding the individual within the data. Think
• 12:21
  about medical research. We want to know trends.
• 12:24
  Does this drug work for people over 50? To answer
• 12:27
  that, we need patient data. But if you query
• 12:30
  a database enough times with specific questions,
• 12:32
  you can triangulate a specific person. How many
• 12:35
  people over 50 live on Smith Street and have
• 12:37
  diabetes? Suddenly you know it's Bob. Exactly.
• 12:41
  Differential privacy fixes this by injecting
• 12:44
  calibrated noise into the results. It's like
• 12:47
  looking at a photo through frosted glass. You
• 12:49
  can clearly see the shape of the tree, but you
• 12:51
  can't count the individual leaves. So the researcher
• 12:54
  gets the trend they need. But BOP remains invisible.
• 12:58
  Correct. It provides a mathematical guarantee
• 13:00
  that the output is statistically accurate for
• 13:03
  the group, but implies nothing about any single
• 13:06
  individual. It protects the entropy of the data.
• 13:09
  Okay, that handles research. But what about processing?
• 13:12
  You mentioned homomorphic encryption as the holy
• 13:14
  grail. That's a big title. It earns it. The biggest
• 13:17
  weakness in security right now is that to do
• 13:19
  anything with data, analyze it, search it, you
• 13:22
  have to decrypt it first. You have to unlock
• 13:25
  the box. And the moment the box is open, the
• 13:27
  data is vulnerable. To the hacker, the malware,
• 13:30
  the rogue employee, everything. So homomorphic
• 13:33
  encryption keeps the box locked. It allows you
• 13:36
  to work inside the locked box. Imagine you have
• 13:38
  a sensitive gold artifact in a locked steel safe.
• 13:41
  You want a specialist to clean it and weigh it.
• 13:44
  In the old world, you give them the key. Trusting
• 13:47
  them entirely. With homomorphic encryption, you
• 13:49
  give them the safe, but you've built special
• 13:51
  gloves into the side of the safe. They can reach
• 13:54
  in, manipulate the object, clean it, weigh it,
• 13:58
  but they can never see it directly or take it
• 14:00
  out. That's a fantastic analogy. Yeah. So a hospital
• 14:04
  could send encrypted data to the cloud. And the
• 14:06
  cloud server runs the algorithms, does the number
• 14:09
  crunching on the gibberish ciphertext, and sends
• 14:12
  the result back. The cloud provider never sees
• 14:14
  the patient's name, never sees the diagnosis.
• 14:16
  The data never exists as plain text outside the
• 14:20
  hospital's control. That seems like it solves
• 14:22
  everything. Why isn't everyone doing this today?
• 14:24
  It's incredibly computationally expensive. Working
• 14:26
  through the gloves is slow. It takes a lot of
• 14:28
  processing power. But for high value data like
• 14:31
  health care or finance, the tradeoff is becoming
• 14:34
  worth it. So the math is the future. But we have
• 14:37
  to survive the present. We established earlier
• 14:39
  that Dave in accounting is still clicking phishing
• 14:42
  links. We can't wait for quantum proof clubs
• 14:44
  to stop that. No. For the human error problem,
• 14:48
  we need a different approach. The buzzword you'll
• 14:50
  hear is zero trust, but it's more than a buzzword.
• 14:53
  It's a philosophy. Trust no one. Sounds paranoid.
• 14:56
  It's professionally paranoid. The old model was
• 14:59
  castle and moat. You have a firewall, the moat.
• 15:02
  Once you cross the drawbridge and log in, you're
• 15:05
  inside the castle. You can roam the halls. And
• 15:08
  if a hacker steals my badge, they can roam the
• 15:10
  halls too. Exactly. Zero Trust says, I don't
• 15:12
  care if you're in the castle. Every single room
• 15:14
  is locked. Every time you want to access a file
• 15:16
  or a server, you have to prove who you are again.
• 15:20
  Continuous authentication. The notes mentioned
• 15:22
  a specific way to do this, technically a jump
• 15:26
  host. Yeah. This is a very practical, immediate
• 15:29
  step organizations can take. Instead of connecting
• 15:32
  your sensitive database directly to your corporate
• 15:34
  network, you put it behind a jump host. Think
• 15:37
  of it like an airlock on a submarine. Okay, I
• 15:39
  like that image. You connect to the jump host
• 15:42
  via a secure VPN. You verify yourself there.
• 15:45
  Then, and only then, does the jump host open
• 15:48
  a connection to the database. It breaks the line
• 15:50
  of sight. So a hacker on my laptop can't see
• 15:52
  the database. They can't just ping the database
• 15:54
  and they hit a wall. The report specifically
• 15:57
  suggests using stable, secure systems like Ubuntu
• 16:00
  with OpenVPN for this. It's not expensive. It's
• 16:03
  just good architecture. And I assume, even with
• 16:06
  airlocks and fancy math, we still need to tell
• 16:08
  Dave not to click the link. You can never stop
• 16:11
  training. Technology fails without people. The
• 16:14
  reports emphasize that security awareness training
• 16:17
  can't be a once a year boring video. It has to
• 16:20
  be constant. You have to build a culture where
• 16:22
  people are suspicious of email. Right. Because
• 16:25
  if you can reduce that 90 percent failure rate,
• 16:27
  the rest of your security stack actually has
• 16:29
  a chance to work. It really is a full spectrum
• 16:31
  battle. We started with the chaos of January
• 16:33
  2026 schools and insurers getting hit. We looked
• 16:36
  at the specific vulnerability of health care.
• 16:38
  We scared ourselves with quantum decryption and
• 16:40
  then, you know, found some hope in homomorphic
• 16:43
  encryption and zero trust. It's an arms race.
• 16:45
  It always has been. But we are getting better
• 16:48
  tools. Before we wrap up, I want to circle back
• 16:50
  to one thing you said about harvest now, decrypt
• 16:53
  later. Yeah. It led to a pretty provocative thought
• 16:56
  in our prep session regarding. Well, data hoarding.
• 16:59
  Yes. This is the question I want every listener
• 17:02
  to ask themselves today. We have been taught
• 17:05
  that data is the new oil, that we should save
• 17:08
  everything because it might be valuable later.
• 17:10
  Right. Data is an asset. But in a world where
• 17:12
  quantum computing breaks encryption, that stockpile
• 17:17
  of data isn't an asset. It's a liability. The
• 17:19
  toxic asset. Exactly. If you don't need the data,
• 17:22
  delete it. Data minimization is the only security
• 17:26
  measure that is 100 % effective. You cannot hack
• 17:29
  what does not exist. That is a powerful takeaway.
• 17:31
  Maybe the best firewall is the delete key. It
• 17:34
  usually is. Well, if this conversation has made
• 17:36
  you realize that maybe your organization's digital
• 17:38
  walls are a bit thinner than you'd like, or if
• 17:41
  you're wondering if your jump host is actually
• 17:43
  set up correctly, you can't do this alone. No,
• 17:45
  you need expertise. You need partners who live
• 17:48
  and breathe this stuff. If you want to discuss
• 17:50
  your security architecture and IT needs, you
• 17:52
  need to head over to www .kinsoft .com .au. That's
• 17:57
  K -I -N -S -O -F -T dot com forward dot A -U.
• 18:01
  Whether it's setting up Zero Trust or just figuring
• 18:03
  out where your data actually lives, they can
• 18:05
  help you navigate the minefield. Don't wait until
• 18:07
  you're the headline. Thanks for joining us on
• 18:09
  Tech Talks with Kinsoft. Stay safe, stay skeptical,
• 18:12
  and we'll catch you next time.